CVE-2025-59181: Ericsson PCC Path Traversal Vulnerability

CVE-2025-59181 Overview

CVE-2025-59181 is a directory traversal vulnerability [CWE-35] in the Configuration Management component of Ericsson Packet Core Controller (PCC) versions prior to 1.39. An authenticated attacker on an adjacent network can traverse directories and modify directory permissions. This action denies access to legitimate users and disrupts normal Packet Core Controller operations.

The flaw affects mobile network operators using Ericsson PCC for 4G and 5G packet core functions. Successful exploitation impacts service availability rather than data confidentiality. Ericsson addressed the issue in PCC version 1.39 and disclosed the vulnerability in its July 2026 security bulletin.

Critical Impact
An adjacent-network attacker with high privileges can alter directory permissions on PCC nodes, denying legitimate users access to configuration resources and disrupting mobile core network operations.

Affected Products

Ericsson Packet Core Controller (PCC) versions prior to 1.39
Deployments using Configuration Management on affected PCC releases
Mobile operator environments running vulnerable PCC nodes for 4G/5G core functions

Discovery Timeline

2026-07-27 - CVE-2025-59181 published to NVD
2026-07-28 - Last updated in NVD database
July 2026 - Ericsson publishes security bulletin for PCC

Technical Details for CVE-2025-59181

Vulnerability Analysis

The vulnerability resides in the Configuration Management interface of Ericsson Packet Core Controller. Input handling for file or directory paths fails to canonicalize traversal sequences such as ../. An authenticated user submits crafted path input through Configuration Management operations. The system then resolves the path outside intended directories and applies permission changes to unintended targets.

The result is unauthorized modification of directory permissions on the PCC host. Legitimate operators, administrators, and internal services lose access to configuration files and directories they require. This produces an availability impact on both configuration workflows and dependent packet core functions. Exploitation requires network access adjacent to the PCC management plane and existing high-privilege credentials.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-35] Path Traversal (.../...//). Configuration Management routines accept path parameters without sufficient normalization or allowlist validation. Path components that reference parent directories escape the intended configuration namespace. The vulnerable code path then invokes permission-change operations against the resolved path.

Attack Vector

The attacker requires adjacent network access to the PCC management interface and valid high-privilege credentials. No user interaction is required. The attacker submits crafted directory paths to Configuration Management endpoints. The vulnerable component changes permissions on directories outside the intended scope, denying access to legitimate users. Consult the Ericsson Security Bulletin July 2026 for technical details.

Detection Methods for CVE-2025-59181

Indicators of Compromise

Unexpected permission changes on PCC configuration directories or files
Configuration Management audit log entries containing path traversal sequences such as ../ or encoded variants
Reports from operators of sudden access denial when reading or editing configuration resources
Administrative sessions from high-privilege accounts performing unusual permission-modification actions

Detection Strategies

Review Configuration Management audit logs for path parameters containing traversal patterns
Correlate permission-change events on the PCC host with the originating management session and user
Baseline expected directory permissions on PCC nodes and alert on deviations
Monitor privileged account activity on the PCC management plane for anomalous configuration operations

Monitoring Recommendations

Forward PCC audit and system logs to a centralized SIEM for retention and correlation
Alert on file system permission changes affecting /etc, configuration directories, and PCC application paths
Track high-privilege login sessions on the PCC management interface for out-of-baseline activity
Verify integrity of configuration directory permissions on a scheduled basis

How to Mitigate CVE-2025-59181

Immediate Actions Required

Upgrade Ericsson Packet Core Controller to version 1.39 or later
Restrict network access to the PCC management interface to a defined administrative segment
Review and reduce the number of accounts holding high privileges on PCC nodes
Audit recent Configuration Management activity for traversal patterns and unexpected permission changes

Patch Information

Ericsson has released Packet Core Controller version 1.39, which remediates the directory traversal in Configuration Management. Operators should plan an upgrade following Ericsson change-management guidance. Refer to the Ericsson Security Bulletin July 2026 for release details and upgrade procedures.

Workarounds

Limit management-plane access to the PCC using network segmentation and jump hosts
Enforce strong authentication and least-privilege on all Configuration Management accounts
Increase audit logging verbosity on Configuration Management operations until patching is complete
Restore correct directory permissions from a known-good baseline if unauthorized changes are detected

bash

# Configuration example
# Restrict PCC management interface to an administrative subnet (illustrative)
# Replace <mgmt_iface>, <admin_subnet>, and <pcc_mgmt_ip> with environment values
iptables -A INPUT -i <mgmt_iface> -s <admin_subnet> -d <pcc_mgmt_ip> -j ACCEPT
iptables -A INPUT -i <mgmt_iface> -d <pcc_mgmt_ip> -j DROP